Fake Zoom installer hides macOS backdoor CloudSyncD

Jamf Threat Labs details CloudSyncD, a macOS backdoor distributed through a fake Zoom installer that hides a phished password using invisible zero-width Unicode characters. Researchers found it on VirusTotal on September 15, still under construction, and watched it evolve within two days.